# Phase 4 Transactional Kernel Preparation Evidence

This slice provides the kernel transaction needed by a future daemon host. It
does not implement protocol translation, run authority, idempotent RPC handling,
authentication, a listener, or OS IPC.

| Contract | Executable evidence |
| --- | --- |
| Prepared new run | `PrepareStart` validates input, leases the current immutable plan, allocates and exposes `RunID`, and constructs the bounded log without engine registration, events, provider work, or a goroutine. |
| Prepared snapshot resume | `PrepareResumeSnapshot` validates the suspended snapshot, compiled compatibility, exact recorded plan, tail cursor, history, and interaction/message identities without publishing authority. |
| Context ownership | Tests cancel setup after preparation and prove both start and resume remain viable; only the separately supplied commit root cancels the running provider and selects the terminal event. |
| Registered-run finalization | Immediate cancellation still commits `RunStarted` through a bounded cancellation-independent lifecycle context and produces exactly one `RunCancelled`. If lifecycle-start persistence cannot commit, the registered run still attempts and records its terminal outcome when capacity permits. |
| Atomic terminal choice | High-contention start and resume tests race `Commit` against `Abort`; exactly one transfers ownership, the other receives a typed state error, and every lease releases exactly once. |
| Duplicate authority | Two preparations for the same snapshot ID are allowed, exactly one engine commit succeeds, the loser releases, and later imports fail before plan acquisition. |
| Failure closure | Nil and pre-canceled setup/root contexts, closed engines, invalid snapshots, plan mismatches, duplicate IDs, release failures, repeated commit/abort/close, and delayed canceled acquisition fail without visible partial runs. |
| Compatibility | Existing `Start` and `ResumeSnapshot` are prepare-plus-commit wrappers and retain ordinary caller-owned lifetime behavior. |

Focused tests, repeated race tests, `make fast`, `make check`, and exact-tree
`make verify` are required before commit. The pushed commit is recorded outside
itself in the canonical ledger.